Netgate SG-1000 microFirewall

Author Topic: Tutorial: Configuring pfSense as VPN client to Private Internet Access  (Read 197963 times)

0 Members and 4 Guests are viewing this topic.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10258
  • Karma: +1176/-313
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #270 on: March 04, 2016, 04:54:46 pm »
Of course it's ^$%&  squid.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline psykix

  • Newbie
  • *
  • Posts: 17
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #271 on: March 04, 2016, 07:05:21 pm »
Since enabling the VPN on my server which runs Plex, I cannot access the Plex server from my LAN via the Plex website.

To get it working previously I had to enable Pure NAT but I don't really understand the reasoning behind this.

Not sure what I need to change to be able to access the server again (I'm basically going out of the firewall, and then back in via my port forward rule to get to it)

Access from the internet to my Plex server is working fine.

Offline psykix

  • Newbie
  • *
  • Posts: 17
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #272 on: March 05, 2016, 04:30:53 am »
Seems Plex suddenly started to work again today. Think may be issues with Plex, so ignore.

Thanks for all the help!

Offline psykix

  • Newbie
  • *
  • Posts: 17
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #273 on: March 05, 2016, 07:29:30 am »
Yes.  Just add the ports to the rule sending traffic to the VPN gateway.  The rule won't match if the port is outside the set so the firewall will move on to the next rule.

I want to do the exact opposite and having trouble figuring it out...

I want all traffic from one IP to go thru the VPN except port 32400 (Plex).  How can I adapt the current rules (or add another) that will send Plex traffic thru the WAN GW so the server can be reached remotely?

John

Did you figure this out? My Plex server stopped working and when I check it has my VPN address as the public IP.

I've tried creating a LAN FW rule above the VPN one to tell it that all TCP 32400 traffic should go via WAN_PPOE and not PIAVPN but it doesn't make any difference.

Offline psykix

  • Newbie
  • *
  • Posts: 17
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #274 on: March 05, 2016, 08:20:26 am »
Never mind - it started working again. I'm wondering if because the VPN changes IP address so often, maybe Plex is taking too long to update it?

Oh I dunno.. clutching at straws - it all works great for a while and then will stop working, and then will work again. Hate those types of issues!

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10258
  • Karma: +1176/-313
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #275 on: March 05, 2016, 12:13:00 pm »
I think the TCP 32400 traffic is INBOUND from Plex. I refuse to use it since they don't post any source addresses so you have to allow the world in.

I believe Plex requires a port forward in on the IP address it is logging in from. So if you are trying to go OUT PIA, I think they need to forward a port to you.

I don't know. Go to a Plex forum and ask exactly what you need in a FIREWALL INDEPENDENT way (just IP/TCP/UDP/NAT/etc) and bring that info back here and it will be easier to help you with that. And you should start another thread for it.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Scorch95

  • Newbie
  • *
  • Posts: 22
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #276 on: March 26, 2016, 05:41:00 pm »
I attempted to set openvpn up with PIA however I am unsuccessful at getting it to connect. Under status it says reconnecting; tls-error. When I check system logs it has this:

Mar 26 17:37:48   openvpn[8951]: Re-using SSL/TLS context
Mar 26 17:37:48   openvpn[8951]: LZO compression initialized
Mar 26 17:37:48   openvpn[8951]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
Mar 26 17:37:48   openvpn[8951]: Socket Buffers: R=[42080->65536] S=[57344->65536]
Mar 26 17:37:48   openvpn[8951]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Mar 26 17:37:48   openvpn[8951]: Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mar 26 17:37:48   openvpn[8951]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mar 26 17:37:48   openvpn[8951]: Local Options hash (VER=V4): '41690919'
Mar 26 17:37:48   openvpn[8951]: Expected Remote Options hash (VER=V4): '530fdded'
Mar 26 17:37:48   openvpn[8951]: UDPv4 link local (bound): [AF_INET]192.168.2.122
Mar 26 17:37:48   openvpn[8951]: UDPv4 link remote: [AF_INET]198.8.80.221:1194
Mar 26 17:37:48   openvpn[8951]: TLS: Initial packet from [AF_INET]198.8.80.221:1194, sid=246e6338 47b9e842
Mar 26 17:37:48   openvpn[8951]: VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=US, ST=OH, L=Columbus, O=Private Internet Access, CN=Private Internet Access CA, emailAddress=secure@privateinternetaccess.com
Mar 26 17:37:48   openvpn[8951]: TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Mar 26 17:37:48   openvpn[8951]: TLS Error: TLS object -> incoming plaintext read error
Mar 26 17:37:48   openvpn[8951]: TLS Error: TLS handshake failed
Mar 26 17:37:48   openvpn[8951]: TCP/UDP: Closing socket
Mar 26 17:37:48   openvpn[8951]: SIGUSR1[soft,tls-error] received, process restarting
Mar 26 17:37:48   openvpn[8951]: Restart pause, 2 second(s)


Edit: well I realized the directions here are different than what is offered on PIAs website. I tried these and it seems to be working. Not sure why this does and theirs don't. Any ideas?
« Last Edit: March 26, 2016, 09:35:54 pm by Scorch95 »

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10258
  • Karma: +1176/-313
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #277 on: March 27, 2016, 03:56:03 am »
It looks like whatever you did there didn't get the correct certificate imported and trusted for that OpenVPN client connection.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline robertfranz

  • Jr. Member
  • **
  • Posts: 35
  • Karma: +1/-6
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #278 on: April 25, 2016, 06:33:49 am »
As much as I appreciate the effort and thoroughness, the advice to simply duplicate all existing outbound nat rules is both overkill, and potentially will degrade a network.

There are often autogenerated rules that are not required.

The isakmp rule specifically cited, for example, is entirely useless on a non ipsec connection.

Nor does the loopback need to be natted in most cases.

And if one blindly duplicates existing nat rules for other vpn connections, you end up double natting those - repeating on the other end gives you quad natting....and things start to not work so much.

I went on a pruning spree the other day and eliminated most of the nat rules.

All you need is one nat rule per subnet/address you are going to route through the vpn.


Offline q54e3w

  • Full Member
  • ***
  • Posts: 164
  • Karma: +16/-1
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #279 on: April 26, 2016, 07:40:17 am »
Nor does the loopback need to be natted in most cases.

Could you share some thoughts or examples of when the loopback interface would need natting please?

Offline techy82

  • Jr. Member
  • **
  • Posts: 94
  • Karma: +2/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #280 on: June 28, 2016, 03:08:58 pm »
I have a I5 6400 cpu should i leave encryption to BF-CBC (128-bit) or could it be increased i have tried aes-256-cbc but i get alot of dropouts

also would i set cryptographic hardware thanks!

Offline reubenb87

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #281 on: July 05, 2016, 05:25:49 am »
Thanks for the awesome guide. I'm having some trouble getting a static IP to get routed through the VPN (all the rest I want to get through the normal WAN). I've made an alias "PIA_VPN_IPs" (IP 192.168.1.230) and made a new LAN firewall rule at the top of the list passing source "PIA_VPN_IPs" to gateway PIAVPN_GW. I can see the traffic getting passed in the log below (I was pinging www.google.com) but I don't get any replies. If I ping 8.8.8.8 it works so I must be getting to the outside world? Could there be some inbound rule that's blocking the pings coming back?

Is there any other way to see what the issue might be? I can ping from within pfsense selecting "PIAVPN" as source address and www.google.com works fine so I'm guessing my VPN connection is ok.

Here are some passed firewall entries:
Jul 5 19:33:56   LAN     192.168.1.230:49388     208.115.201.203:25915   TCP:S
Jul 5 19:33:54   LAN     192.168.1.230     8.8.8.8   ICMP
Jul 5 19:33:54   LAN     192.168.1.230:49387     208.115.201.203:25915   TCP:S
Jul 5 19:33:52   LAN     192.168.1.230:49386     150.101.60.234:443   TCP:S
Jul 5 19:33:48   LAN     192.168.1.230:49385     150.101.60.208:443   TCP:S
Jul 5 19:33:48   LAN     192.168.1.230:49384     150.101.60.208:443   TCP:S
Jul 5 19:33:44   LAN     192.168.1.230:49383     128.121.22.145:443   TCP:S
Jul 5 19:33:44   LAN     192.168.1.230     150.101.60.230   ICMP
Jul 5 19:33:44   LAN     192.168.1.230:53406     8.8.8.8:53   UDP
Jul 5 19:33:41   LAN     192.168.1.230:49382     208.115.201.203:25915   TCP:S
Jul 5 19:33:35   LAN     192.168.1.230:49381     208.115.201.203:25915   TCP:S

Offline dambulti

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #282 on: July 12, 2016, 03:28:51 am »
Albeit all data are here is adequate yet it you will Create OpenVPN interface then you have to run with this.

- Click "Interfaces"

- Click "(allocate)"

- "Accessible system ports:" select "ovpnc1(PIA OpenVPN)"

- Click "include chose interface" (symbol is a "+" image on a little lined sheet of paper)

However for more vpn Configuring you may likewise investigate toptenvpnreviews

www.toptenvpnreviews.com

Offline humungus

  • Newbie
  • *
  • Posts: 17
  • Karma: +1/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #283 on: July 12, 2016, 09:11:27 pm »
Today an announcement was sent and the openvpn.zip was updated. I believe I have all of the necessary steps/changes at the bottom to come up on the new cert Please let me know if this works for you... (Relevant bit highlighted below)


To Our Beloved Users,
 
The Russian Government has passed a new law that mandates that every provider must log all Russian internet traffic for up to a year. We believe that due to the enforcement regime surrounding this new law, some of our Russian Servers (RU) were recently seized by Russian Authorities, without notice or any type of due process. We think its because we are the most outspoken and only verified no-log VPN provider.

Luckily, since we do not log any traffic or session data, period, no data has been compromised. Our users are, and will always be, private and secure.

Upon learning of the above, we immediately discontinued our Russian gateways and will no longer be doing business in the region.

To make it clear, the privacy and security of our users is our number one priority. For preventative reasons, we are rotating all of our certificates. Furthermore, were updating our client applications with improved security measures to mitigate circumstances like this in the future, on top of what is already in place. In addition, our manual configurations now support the strongest new encryption algorithms including AES-256, SHA-256, and RSA-4096.

All Private Internet Access users must update their desktop clients at https://www.privateinternetaccess.com/pages/client-support/ and our Android App at Google Play. Manual openvpn configurations users must also download the new config files from the client download page.

We have decided not to do business within the Russian territory. Were going to be further evaluating other countries and their policies.

In any event, we are aware that there may be times that notice and due process are forgone. However, we do not log and are default secure against seizure.
 
If you have any questions, please contact us at helpdesk@privateinternetaccess.com.

Thank you for your continued support and helping us fight the good fight.
 
 
 
Sincerely,
Private Internet Access Team


*******************************************************************************************************



Steps you will need to take to continue to use this guide in the future with the new certificate or for anyone using it now who wants to use the new cert ("before/if" they revoke it.) 

1. grab the new openvpn.zip (same location as before)

1.  repaste new cert (ca.rsa.2048.crt) into field where ca.crt is/would go

2. on the openvpn client tab change to "aes-128-cbc" from the pull down options for Encryption Algorithm .

3. change server port from 1194 to 1198

4. you could restart openvpn, but I prefer a reboot. :)

« Last Edit: July 13, 2016, 06:49:50 am by humungus »

Offline AndrewZ

  • Full Member
  • ***
  • Posts: 299
  • Karma: +28/-0
    • View Profile
Re: Tutorial: Configuring pfSense as VPN client to Private Internet Access
« Reply #284 on: July 13, 2016, 03:58:48 am »
We're not limited to AES-128 and 2048 bit cert, higher values - 256 and 4096 - are supported already, see https://forum.pfsense.org/index.php?topic=103934.msg634754#msg634754

These strong settings are available on UDP port 1197 and on TCP port 501 (at least).

Very useful article on PIA site: https://helpdesk.privateinternetaccess.com/hc/en-us/articles/225274288-Which-encryption-auth-settings-should-I-use-for-ports-on-your-gateways-
« Last Edit: October 26, 2016, 12:51:53 pm by AndrewZ »